Live › vulnerability › CVE-2026-114598
Go to dashboardEPICS Base release 7.0.10 and earlier does not validate element or length values in a network message, so a crafted message can make the application read past an allocated buffer. An attacker can crash the service (denial of service) and may read adjacent memory contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Any site running EPICS Base 7.0.10 or earlier with an IOC, gateway or client exposed to the network, since the flaw is in parsing network messages. Systems with no network exposure to EPICS channel access traffic are less exposed. The sources do not say which message types or ports trigger it.
No product ranges from the sources yet.
7.0.10 (e.g. grep -r "EPICS_VERSION" <epics-base>/configure/CONFIG_BASE_VERSION or the base directory name)7.0.10 (fixed version unknown from sources; check the EPICS Base release notes)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
This page as .md · .json · in your agent: get_signal("CVE-2026-114598")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.